<html>


<meta http-equiv="Content-Type" content="text/html;charset=UTF-8">
<head>

<meta name="GENERATOR" content="Microsoft FrontPage 6.0">
<link href="File%20Records_files/topic000.css" rel="stylesheet" type="text/css">
<title>File Records</title>
</head>

<body>

<h1>File Records</h1>

<p>A file record consists of a header and one or several attributes of arbitrary length terminated by an end marker&nbsp;(a 32-bit FF FF FF FFh value). Although the number and length of attributes vary between different file records, the size of the file record structure itself is fixed and in most cases it is equal to 1&nbsp;Kb (the value is stored in the $?oot file). The first byte of a file record always matches sector beginning.</p>

<h6 align="center"><strong>Header, Attribute 1, Attribute 2, … , Attribute N, End marker.</strong></h6>

<h6 align="center">File record structure</h6>

<p align="center">If actual length of attributes is less than the file record size, its end will simply remain unused. If attributes do not fit within the space allocated for them, an extra File Record referencing the initial record will be created.</p>

<p align="center">File record structure</p>

<p align="center"><img src="File%20Records_files/mft_0200.gif"></p>

<p align="center">File record signature. The first bytes in a header take the 46 49 4C 45h ("FILE") value indicating that you are dealing with an MFT entry of the File&nbsp;Record type. </p>

<h6 align="center"><img src="File%20Records_files/mft_0300.gif"></h6>

<h6 align="center">File record signature</h6>

<p align="center">Offset of update sequence number. After the signature there is a 16-bit bit number reflecting the offset of the update sequence number (please see the <a href="http://www.pc-3000flash.com/eng/help/help_information/ntfs/update_sequence.htm">Update Sequence section</a>).</p>

<h6 align="center"><img src="File%20Records_files/mft_0400.gif"></h6>

<h6 align="center">Offset of update sequence number</h6>

<p align="center">Header size (which varies between different operating systems) is not specified explicitly. Instead, the header includes a 16-bit number located at offset 14h bytes from the sector beginning, which contains the first attribute offset in bytes relatively to the file record beginning. Offsets of the next attributes (if any) are identified by adding the sizes of all previous attributes (the size of each attribute is specified in its header) to the first attribute offset (please see the <a href="http://www.pc-3000flash.com/eng/help/help_information/ntfs/attribute.htm">Attributes</a> section for details). The end of the last attribute contains a 32-bit end marker&nbsp;– FF FF FF FFh.</p>

<h6 align="center"><img src="File%20Records_files/mft_0500.gif"></h6>

<h6 align="center">First element pointer, end marker</h6>

<p align="center">File record length is stored in two 32-bit fields. The real size field at offset 18h bytes from the sector start contains the total size of the header, all its attributes and the end marker rounded by the 8-bit border. The allocated size field at offset 1?h bytes from the sector start contains the number of bytes allocated to file record rounded to the sector size.</p>

<p align="center">For the 16-bit flags field located at offset 16h byte from the sector start the following three values are defined: 00h&nbsp;– the file record is not used or the file/directory associated with it is removed, 01h&nbsp;– file record is used and describes a file, 02h&nbsp;– file record is used and describes a directory. It is obvious that the value of that field is produced as a result of addition of the attributes defined for it, i.e. the file record describing a directory has the value equal to 01h + 02h = 03h. Undocumented attributes 04h and 08h, probably, may contain information about the file system version (NT, 2K); they are used with such system files as $Secure, $Quota, $ObjID, $Reparse, and $UsnJrnl. </p>

<h6 align="center"><img src="File%20Records_files/mft_0600.gif"></h6>

<h6 align="center">Flag, real size and allocated size fields</h6>

<p align="center">The 64-bit field at offset 20h bytes from the sector start contains the index number of the base file record. The field is always equal to zero for the first file record; for all extra records it will be equal to the number of the base file record. Extra file records can be located in any MFT parts; they do not have to be close to the base record. In order to provide for fast search of extra file records, an $ATTRIBUTE_LIST is maintained. The list of attributes is a special attribute added to the first file record and containing the index numbers of extra records. Attribute list format is described in the <a href="http://www.pc-3000flash.com/eng/help/help_information/ntfs/attribute.htm">Types of attributes</a> section.</p>

<h6 align="center"><img src="File%20Records_files/mft_0700.gif"></h6>

<h6 align="center">Index numbers of the base and current file records</h6>

<p align="center"><br>
</p>

<p align="center"><br>
</p>
</body>
</html>

<!-- This document saved from http://www.pc-3000flash.com/eng/help/help_information/ntfs/file_record.htm -->
